How to add a service tag to Microsoft tenant Azure network security manager

Hi Eddie Caraballo

We understood that you're looking to add a new service tag to your network security rules in Azure.

Kindly check below steps:

1. Create or Edit a Security Admin Configuration and Select your Network Manager instance.

Under Settings, click Configurations choose to either: Create a new security admin configuration, or edit an existing one.

1. Add a Rule Collection In the configuration, go to the Rule collections tab, click Add to create a new rule collection.

• Provide:
• A name
• Target network groups (where the rule will apply)

3,Add a Security Admin Rule with a Service Tag, Inside the rule collection, click Add a rule.

Fill in the following:

Name and Description

Priority (lower numbers = higher priority)

Action: Allow, Deny, or Always Allow

Direction: Inbound or Outbound

Protocol: TCP, UDP, or Any

Source Type: Choose Service Tag

Then select the service tag (e.g., AzureCloud, Storage, or your newly onboarded tag)

• Destination Type: Choose Network Group or IP/CIDR as needed

Ports: Specify source and destination ports

Service tags represent groups of IP address prefixes managed by Microsoft. They simplify rule creation by abstracting IP ranges.

For more information, please check this document https://learn.microsoft.com/en-us/azure/virtual-network-manager/how-to-create-security-admin-rule-network-group

I hope this helps! If these answers your query, do click the "Upvote" of which might be beneficial to other community members reading this thread.

If the above is unclear or you are unsure about something, please add a comment below.